Skip to main content

Questions tagged [linear-cryptanalysis]

Linear cryptanalysis is a known plaintext attack and uses a linear approximation to describe the behavior of the block cipher. Given sufficient pairs of plaintext and corresponding ciphertext, bits of information about the key can be obtained and increased amounts of data will usually give a higher probability of success.

22 questions with no upvoted or accepted answers
Filter by
Sorted by
Tagged with
4 votes
0 answers
79 views

Help with cryptanalysis of branching in schemes based on Multivariate Public Key Cryptography

I'm familiarized with the structure of branching found in Multivariate Cryptography, as it allows us to partition a $n$-tuple over $F_{q}$ into a $k$-tuple where the $i$-th element is in $F_{q^{\...
kub0x's user avatar
  • 898
3 votes
0 answers
290 views

Understanding Linear Cryptanalysis

I'm reading about the linear cryptanalysis of an SPN and I have some questions about the practicality of this. The example I'm looking at is from 3.3.3 of Stinson's Book and I believe the same example ...
Rdrr's user avatar
  • 141
3 votes
0 answers
323 views

Linear cryptanalysis of FEAL-4

I am trying to find the sub keys of a FEAL-4 cipher. I am able to get a number of possibilities for $K_0$ after using Michael Stamps formula using a as a constant and going through $2^{32}$ keys. The ...
liam waters's user avatar
3 votes
0 answers
59 views

Finding maximal $n$-affine subset

We obtained $l$ vectors $B_i$ of $c$ bits $b_{i,j}$. These are an altered form of vectors $A_i$ where the last $n$ bits of each $A_i$ are an affine function of the other bits of that $A_i$. We want ...
fgrieu's user avatar
  • 142k
3 votes
0 answers
314 views

Breaking linear blockcipher - expanding recursive formula

I am trying to break a block cipher that can be defined as follows: We have 12 rounds and at each round, we perform the following operation. We split 64 bit data into 2 parts each 32-bits, $\ x_r$ and ...
Maciej Żurad's user avatar
2 votes
0 answers
79 views

Linear approximation of modular addition of a constant?

In Linear Approximations of Additions Modulo $2^n$, Wallén shows how to compute the correlation of the modular addition of two binary bit vectors. A simple recursive procedure was given by Schulte-...
Federico Lebrón's user avatar
2 votes
0 answers
56 views

(Enhancing Linear-Differential Cryptanalysis - Biham et al.) Diff-Lin Extension Characteristic and Characteristic Probability

I studied Langford and Hellman's Differential-Linear Cryptanalysis and moved on to Biham, Dunkelman and Keller's Enhancing Linear-Differential Cryptanalysis. In the paper, although I've read many ...
Ahmet Sakal's user avatar
2 votes
0 answers
48 views

Linear approximattion of $(x+y) \bmod 2^n$ in FSM of SNOW 2.0 where $x,y$ in $F_{2}^n$

I would like to understand the linear approximation of $(x+y) \bmod 2^n$ by linear masking method in the paper refereed ""Improved Linear Distinguis'hers for SNOW 2.0" by Kaisa Nyberg and Johan Wall´...
Subrata Nandi's user avatar
2 votes
0 answers
118 views

Enhancing Differential-Linear Cryptanalysis

I'm studying Differential-Linear Cryptanalysis, and I'm trying to understand the context from the article Enhancing Differential-Linear Cryptanalysis by Eli Biham et al. There are some difficult ...
pioneer's user avatar
  • 325
2 votes
0 answers
147 views

Known Plaintext Attack A5/2

I am trying to understand the non-optimized known plaintext attack on A5/2 from Barkan, Bikan and Keller. I don't understand the construction of the equation system: $$S_{R4_1} * S_1 = k$$ Where $S$ ...
Schroder22's user avatar
2 votes
0 answers
162 views

How can I identify the linear equations for a block cipher with 4 different s-boxes?

For a block cipher with 4 different s-boxes (each used in an individual round) how can I identify the linear equations? Normally, for ciphers like AES with a single s-box, linear cryptanalysis can be ...
Chaitanya 's user avatar
2 votes
0 answers
266 views

If we use another irreducible polynomial for AES how can we show it is still resistant to DCA and LCA?

AES has been rigorously tested against all known attacks. However, I believe there are 30 suitable irreducible polynomials that could be used for AES. If we were to change the current irreducible poly ...
Red Book 1's user avatar
  • 1,025
1 vote
0 answers
51 views

How does one produce this in the linear cryptanalysis of DES

I understand how this linear approximation board below is produced, but I can't understand how this second board is produced using the first one and finally how the pilling-up lemma values are ...
whatevahhh's user avatar
1 vote
0 answers
118 views

How does an attacker decrypt a hash function by looking for linearity?

Reading the selected answer to Designing a hash function from first principles rather than depending on heuristics is very insightful. The section on "nonlinearity" suggests that making ...
Lance's user avatar
  • 171
1 vote
0 answers
76 views

In DES : Matsui's notation(LC) vs Biham's notation(DC)

I'm doing linear attack for 8 rounds DES. And I just wondering about the difference between Matsui's notation and Biham's notation. In Matsui's paper, numbers bits from 0 to 63 from right to left. In ...
pioneer's user avatar
  • 325
1 vote
0 answers
68 views

Are there methods for finding not optimal but good linear approximations for functions?

I'm interested in finding the best, or maybe just a good linear approximation of the function $F^{(19)}: V_{56}\to V_8$, where $$ \begin{array}{l} F^{(1)}(x_1,x_2,\ldots, x_7) = P(x_2+x_6); \\ F^{(...
Mikhail Goltvanitsa's user avatar
1 vote
0 answers
225 views

How to apply linear cryptanalysis to PRESENT?

Can someone help me implement linear cryptanalysis of the PRESENT block cipher? How should I start with 64 bits of plaintext and 80 bits of key?
Mehak Khurana's user avatar
0 votes
0 answers
54 views

Is there any lemma or theorem for finding the following output linear masks?

Let $\operatorname{rotl32}(x,2)$ be rotating a 32 bit word $x$ to the left by 2, and $+$ be modular addition on 32 bit, meaning$\pmod{2^{32}}$; and $Z_2^{32}$ be the space of all 32 bit words. Now we ...
Vahid's user avatar
  • 39
0 votes
0 answers
55 views

Is there a square matrix with applications in Cryptography such that the determinant of this matrix is 0 and all its sub minors are non-singular?

I am looking for a square matrix whose determinant is 0, however, all sub-minors of this matrix are non singular. This matrix needs to have applications in Cryptography. The matrix may be over any ...
Kurious Koder's user avatar
0 votes
0 answers
61 views

How to estimate the bias of linear cryptanalysis given the input and output masks

Assume the input linear mask is $a$, and output mask is $b$,for a block cipher $F$ with $r$ round,How to accurately and quickly estimate the bias of linear cryptanalysis? which is \begin{equation*} ...
HelloSpace's user avatar
0 votes
0 answers
115 views

Can a modulo function be linearized or alternatively expressed?

In order to try to simplify or alternatively express cryptographic functions I wonder if the modulo function can be alternatively expressed. Could for example a Fourier series of a sawtooth wave or ...
David Jonsson's user avatar
0 votes
1 answer
2k views

How does non-linearity (S-box) add security to AES?

I'm trying to understand how AES guarentees security. One of the named points on the web is that AES uses a non-linear step (the SubBytes step). But how exactly does the Rijndael key schedule add ...
Thomas Wagenaar's user avatar